diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index 1844873685..183f1270ee 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -4,6 +4,23 @@ All notable changes to the **Prowler API** are documented in this file. +## [1.40.1] (Prowler v5.39.1) + +### 🔄 Changed + +- Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 to match the SDK; the cryptography override now names its actual blockers (azure-cli-core pins msal below 1.37, workos 8.3.0 requires cryptography 48) [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477) + +### 🐞 Fixed + +- Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477) + +### 🔐 Security + +- Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net` [(#12445)](https://github.com/prowler-cloud/prowler/pull/12445) +- Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615 [(#12470)](https://github.com/prowler-cloud/prowler/pull/12470) + +--- + ## [1.40.0] (Prowler v5.39.0) ### 🔄 Changed diff --git a/api/changelog.d/api-align-sdk-cryptography-caps.changed.md b/api/changelog.d/api-align-sdk-cryptography-caps.changed.md deleted file mode 100644 index 98052ac0b4..0000000000 --- a/api/changelog.d/api-align-sdk-cryptography-caps.changed.md +++ /dev/null @@ -1 +0,0 @@ -Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 to match the SDK; the cryptography override now names its actual blockers (azure-cli-core pins msal below 1.37, workos 8.3.0 requires cryptography 48) diff --git a/api/changelog.d/api-trivy-0730-bump.security.md b/api/changelog.d/api-trivy-0730-bump.security.md deleted file mode 100644 index a9ec43c86d..0000000000 --- a/api/changelog.d/api-trivy-0730-bump.security.md +++ /dev/null @@ -1 +0,0 @@ -Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net` diff --git a/api/changelog.d/api-trivy-0740-bump.security.md b/api/changelog.d/api-trivy-0740-bump.security.md deleted file mode 100644 index 3a7df41ed3..0000000000 --- a/api/changelog.d/api-trivy-0740-bump.security.md +++ /dev/null @@ -1 +0,0 @@ -Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615 diff --git a/api/changelog.d/api-zstd-yanked-pin.fixed.md b/api/changelog.d/api-zstd-yanked-pin.fixed.md deleted file mode 100644 index 4ceb5d23e5..0000000000 --- a/api/changelog.d/api-zstd-yanked-pin.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index f2c33f123e..076bffb52a 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -4,6 +4,22 @@ All notable changes to the **Prowler SDK** are documented in this file. +## [5.39.1] (Prowler v5.39.1) + +### 🐞 Fixed + +- Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 so the published wheel installs with cryptography 50.0.0; 5.38.0 declared cryptography 50.0.0 while those packages capped it below 50, so pip could not install it and `pip install prowler` silently fell back to 5.37.1 [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477) +- Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477) +- ECS task-definition checks no longer report PASS when `DescribeTaskDefinition` fails before container evidence is gathered [(#12478)](https://github.com/prowler-cloud/prowler/pull/12478) +- `ses_identity_not_publicly_accessible` now evaluates every SES identity authorization policy and marks mixed public Allow and Deny statements for manual review [(#12480)](https://github.com/prowler-cloud/prowler/pull/12480) + +### 🔐 Security + +- Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net` [(#12445)](https://github.com/prowler-cloud/prowler/pull/12445) +- Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the SDK container image, patching Go standard library vulnerabilities and CVE-2026-53615 [(#12470)](https://github.com/prowler-cloud/prowler/pull/12470) + +--- + ## [5.39.0] (Prowler v5.39.0) ### 🚀 Added diff --git a/prowler/changelog.d/ecs-undescribed-task-definitions.fixed.md b/prowler/changelog.d/ecs-undescribed-task-definitions.fixed.md deleted file mode 100644 index 8e07ade65b..0000000000 --- a/prowler/changelog.d/ecs-undescribed-task-definitions.fixed.md +++ /dev/null @@ -1 +0,0 @@ -ECS task-definition checks no longer report PASS when `DescribeTaskDefinition` fails before container evidence is gathered diff --git a/prowler/changelog.d/installable-wheel-cryptography-caps.fixed.md b/prowler/changelog.d/installable-wheel-cryptography-caps.fixed.md deleted file mode 100644 index 8cda911efe..0000000000 --- a/prowler/changelog.d/installable-wheel-cryptography-caps.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 so the published wheel installs with cryptography 50.0.0; 5.38.0 declared cryptography 50.0.0 while those packages capped it below 50, so pip could not install it and `pip install prowler` silently fell back to 5.37.1 diff --git a/prowler/changelog.d/ses-multiple-authorization-policies.fixed.md b/prowler/changelog.d/ses-multiple-authorization-policies.fixed.md deleted file mode 100644 index 0fe2961905..0000000000 --- a/prowler/changelog.d/ses-multiple-authorization-policies.fixed.md +++ /dev/null @@ -1 +0,0 @@ -`ses_identity_not_publicly_accessible` now evaluates every SES identity authorization policy and marks mixed public Allow and Deny statements for manual review diff --git a/prowler/changelog.d/trivy-0730-bump.security.md b/prowler/changelog.d/trivy-0730-bump.security.md deleted file mode 100644 index a9ec43c86d..0000000000 --- a/prowler/changelog.d/trivy-0730-bump.security.md +++ /dev/null @@ -1 +0,0 @@ -Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net` diff --git a/prowler/changelog.d/trivy-0740-bump.security.md b/prowler/changelog.d/trivy-0740-bump.security.md deleted file mode 100644 index 2aaf6882f6..0000000000 --- a/prowler/changelog.d/trivy-0740-bump.security.md +++ /dev/null @@ -1 +0,0 @@ -Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the SDK container image, patching Go standard library vulnerabilities and CVE-2026-53615 diff --git a/prowler/changelog.d/zstd-yanked-pin.fixed.md b/prowler/changelog.d/zstd-yanked-pin.fixed.md deleted file mode 100644 index 4ceb5d23e5..0000000000 --- a/prowler/changelog.d/zstd-yanked-pin.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe